access.go RawHistoryFolder

1// SPDX-License-Identifier: AGPL-3.0-or-later
2
3package app
4
5import "bnema.dev/ermite/internal/domain"
6
7// canRead is the access rule for reading a repository, the single place that
8// decides it: root reads everything, anyone reads a public repository, and a
9// stored token reads a private one only with repo:read on it (the scope, and
10// the repository within its list). Callers answer domain.ErrNotFound when it
11// is false, so a private repository never shows itself.
12func canRead(p domain.Principal, repo domain.Repo) bool {
13	return canReadAs(p, repo.Name, repo.Visibility)
14}
15
16// canReadAs is canRead for a repository known by its name and visibility only,
17// such as one that no longer exists.
18func canReadAs(p domain.Principal, name domain.RepoName, vis domain.Visibility) bool {
19	if vis == domain.VisibilityPublic {
20		return true
21	}
22	return p.Allows(domain.ScopeRepoRead, name)
23}
24
25// adminAccess is the access rule for changing or deleting a repository. A
26// caller that may not administer it learns nothing it could not already read:
27// not found when it cannot see the repository, unauthenticated when it is
28// anonymous, forbidden otherwise.
29func adminAccess(p domain.Principal, repo domain.Repo) error {
30	switch {
31	case canAdmin(p, repo.Name):
32		return nil
33	case !canRead(p, repo):
34		return domain.ErrNotFound
35	case p.IsAnonymous():
36		return domain.ErrUnauthenticated
37	}
38	return domain.ErrForbidden
39}
40
41// canWrite is the access rule for pushing to a repository, or creating it on
42// first push: repo:write on it.
43func canWrite(p domain.Principal, name domain.RepoName) bool {
44	return p.Allows(domain.ScopeRepoWrite, name)
45}
46
47// canManageTokens is the access rule for creating, listing and revoking
48// stored tokens: token:admin, which root holds.
49func canManageTokens(p domain.Principal) bool {
50	return p.HasScope(domain.ScopeTokenAdmin)
51}
52
53// canAdmin is the access rule for deleting a repository and changing its
54// visibility, description or default branch: repo:admin on it.
55func canAdmin(p domain.Principal, name domain.RepoName) bool {
56	return p.Allows(domain.ScopeRepoAdmin, name)
57}